b86fb3450faab615a0e27f9c9d9b575812222e390636e7f6cf40b4902da948da

Analysis

max time kernel
120s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fda4bf499db5bdc51579b0beff8645b.html
Size

14KB
MD5

7fda4bf499db5bdc51579b0beff8645b
SHA1

ddc8a452becefac47c46fc0bc5279a3738c62601
SHA256

b86fb3450faab615a0e27f9c9d9b575812222e390636e7f6cf40b4902da948da
SHA512

b144d8ea55b5b2e39daa4ee359f4e6e6238f6b7df98e3524c6abd0182060cce0ebadd9e73401fa846c2c62580c8cf4bdc6fd71e610aa29e2a92492478e9f97b7
SSDEEP

192:+yEioELD/ZmXg8oWllefMJkZQ3wf1vrmlKt6DvE:aioWD/ZmXg8SZQ+mlXrE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14D291C1-A194-11EE-8495-CEEF1DCBEAFA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0030cfe9a035da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000014271212589ea3b154ec3b4bfa8df0b24ea60cdcc70787839f8019584a89e02c000000000e8000000002000020000000458917f4cc89c318c6e70b352225d53a7b17a9a61f48ecd5c25b729bd94c69dd20000000846861ca55e23c20061efe20ed1a05ed52c58420e83fd6df0b5026e21b73ec0c400000001dec8c9bafa1a22079a4b06734328cdd0584ba5028093117cc74967ef427f060da1832a20a1d269ff531b4f6e610a7b21be9df840488a0edf1cefe78f92b105d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f0b297dbe1b9680e194a355d7aeb5dece9bf64586eb9827b2f733f27e2e6726d000000000e8000000002000020000000fba9d191e65c4e706ae531513d571359e85741cbf25e8e0faacf2ba15dfcaba89000000066e619ab2baa7ac3526e05dfb745e72b4ec389dd058c643cd20c7206e6415d84d76c83fdcf021d1b7c7e11dc2a9ad6d71266ec7c39dc6dd8aa80932c31fc884bb42572be9b5ac9fec89c45e446f082d4068344889f23e701b4d97a5e54ee9851f5c363934fd061a89b0fb837cb15a9766a995f9f24a904058a574e41ba80e1fb42febadcd3fd205efd2e4cb024f8ba64400000001b078bb2a6b83606b5d9746720d1044168cf4de884b62cef0abe3f5d85c429aab10ed270c6264a27345e538fa50ff5b827b16a21cd3e9e3babf1020291a3aa45	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409498659"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2296	2204	iexplore.exe	28
PID 2204 wrote to memory of 2296	2204	iexplore.exe	28
PID 2204 wrote to memory of 2296	2204	iexplore.exe	28
PID 2204 wrote to memory of 2296	2204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7fda4bf499db5bdc51579b0beff8645b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
deb0718e215d8b1a3dc8c0c75ce52201

SHA1
29dba46894dc855d81ba16faeb3711575c4b977a

SHA256
2b511f32f6f0693d1075c86b8666d77864d430c14122164c93a761e42fab25b6

SHA512
7dea4d3a7e0c06bf66d3e3fc12173e3ecdd024acf72712e519d071e2eb19269169641412a1da0c7d7f3e0ee4b367de3db398a7ecd5bc87c1ff09392df2859575

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e537bb52032c1c2221620a5174c3054

SHA1
0cef236674cce3d22bc140c0007ebe36eb6ae0a7

SHA256
95aab9ec61e3ddec74ab960582ce2531d6cca567380fbb1d8daf9d0223f29d88

SHA512
f9ec9c80ee42cb89fa2730bace4f3034da8c383feb6ddbe8710f60b78cfd7f762499c3c1748cac941e8ebbd023b691e4e56db35f1812e7a290a2ddf636345b12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11144b1107fa2d4a23071025ccf44fbc

SHA1
7ac2c6fb0332122d75d300329b20ae21f86f8f0f

SHA256
db21893db753617488f3aec1dda5a73ef540812603929fe8ec56bda945905313

SHA512
514660568b36ae3f50c73de5b135850ced6d563cc0c1b0385ecf32d55b945dbe60b2ad8e05eacebdd57ff134dd6f6a3fff9489ee1fa0f877c829464d14307b29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b81a8361b0b8d02ec0a2be626f72eed

SHA1
617a56e8ae390fd99724ccd0c776d6396a6b4707

SHA256
0b641c27797b2e505d1f085197c9ffa718ddfe4b712670cbc1abf52d83121ced

SHA512
992e09ef337d7daa24e109b0ec38c87f624ef97bb4b7fedd5494b4dbb709033e9637b2e48979f54631d1b4b0e4e441dacb05d0f94dab17d1f8c768efe0718d2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f935ad04fcc46865ef9deb5cd111d11

SHA1
5d9a97028748981798f2bbe73f42d0d1288a8766

SHA256
39caec4c1165935c07d873868a133193155ad7947826a6960192d872509e24c6

SHA512
8949d6503e13493fc116b9f7f322d94c6ce2dc8866600a84aefa4cfe36dd5ea43ef55c0714e872590b7962ca1d54fef2a8440882dc9c8317ade158c231b173a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2ee39a37f51c12c1d93bdeb99e35611

SHA1
5da09b369ec5beb07e4403212962e80987a0f30f

SHA256
75ea91718452fec069163ca801a479a9b6c0705487072517a9bcb59da9e3b59d

SHA512
d81ff837a77f021068b589d230c03cea5f6d4a7ad857da5e3bf8d69e1cbec3ecfa14188893bb20cc27c07a9bcde2e351eb9812a19a6cbe8c50734ea74e69c584

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de1e3fc96d0cb3f01e501e25cafbcd5a

SHA1
a3db8b272c46097d67a5e8f216975d9c29a4a8c1

SHA256
8d1bfdfa500bea88581fa5f18aed4aa32edc6f5f2d67a4e29d38d65c0069df20

SHA512
a061ef2325774df570b840a20d11e92d8911abef1c8e84a2f3c896da7703d5375a5599b3ea7483ccea8b3af269842d9ea8334c9b6e5d91353d4b975e1ef556e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d371f00fcd136463c6ca8164d7944878

SHA1
f57564094729be73936fc7b92451c868aa2875b2

SHA256
0db43dc74b1fd365a4edf3703c7a20b998d4877ac8f5d224b1eba15e0ffac916

SHA512
ae8062bec8c8b1f4a098addb6c964c7d6e61b6083ffa29b0cab71cb73d686cc840f38426648a11c41573ea53eb0eaa18f6ff63ab5fa3d7218175e6123c4782ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e51de2d201c50376016dfbb18820217

SHA1
846cfc18034c87f8c5fd183586cd9de7e034fb74

SHA256
2d42a4ae1f4892212e919ea20d9b8fa93d0f42a701ac84894e3057dcf999d78e

SHA512
3968b28cfeee4d6186cb5dc34cc37f23be10528c93f788f0021433573ca73201f42c8abfec0d7a2ca7ff79db486193756bb3fe5c8c21c597ff05dcea1d29a838

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35e36eb4bcd876882788ebee401135d4

SHA1
a7dfd68fe84b445ecd0057150cacb74e54a98dfc

SHA256
f40c8ab335b77fa595f82488c29546aa94b222de2de4a30ae2538df3c1cc1c14

SHA512
7d66f4fb330140f5ae8eb69bf7cf0f89d6941144501c3b850907682863f566775ae8e1ba9c9c7a85a29f72fcb5fb24dc604b3f8cd91c839203a756b5f84879e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d12f7bd95ccc48c62a39a1e022731e8b

SHA1
bb01044d43feba0e4fe5eb90a7c1cbc5052e3afe

SHA256
58e5010842dfadd14f7645cff00aa3146098431104d962affc460b6a98f1e741

SHA512
5a0e20406bc32f28f0ddb875f74c296fd8f2eacde9c5d71f99d934926911cef4cc3312fad38600a0ccd48e336608eb327dcf43ceb7378bdeaad8c29b3fa969b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6cc2ab97bff6c2186862926da39d68a

SHA1
8ff3c130d637610943f33aa55057b02d74610c3a

SHA256
9cfdfc79a3cc77b7ad5f2217cf2e4f218fa597e80aa73cea2a058456d67ffccf

SHA512
2ee1ea86a1f9a7f27719a8368ae6ed19e3f92bbb7bc5872552eadf4afdd71d07961d0e5308b1c7118e05295175dfbd948d343188fb2dd4ff0859b46c7be30e00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa5f2d7147bdf2a784e73141dde8efdd

SHA1
e33e2952f3f66bd44c1306951857113b11d3163e

SHA256
62bbcbbb803ad2b8b3759af189fa9dee26af910e362c7bdc847351ae8037e896

SHA512
9ea2669f0e8b1f93dfeaa9651a74ab5bf359d1f099d37dc2f9379d35b1d0a896ced20cd1b4082ee14669e824f47370ef0bb95bcd4bdf2890eb8fe14a6a5e87d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7dc26f51113b8b544a0e84512547e635

SHA1
fdf647605e60dad64844efd193324e818c931279

SHA256
f4b2301235b9c4c89f77b58665f27819b84b0e4949495898943463db5600df64

SHA512
8a4a6b3e97ff6aebe9d117fe48b369e47b25629d30d8001e8d6c43c4030f9d52a69bcc9e2ad692b9429b7e243d049251e462817fea44407c0372da0cfda28255

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a9583a4071eafdaea675d6b6816d02d

SHA1
aa2d6deaca8584e36bfebe2827f94b16f0340e0f

SHA256
235ee2bf69184aae848d84470df911007fcb7e21d40cf4aa66e1ed566c5ddc84

SHA512
0836cda9309615e5bf0d159ae3b7ec85f9c4001949d2f724c3fc0dbdacf050e060e1a24ecaf1c9e324530431d497a16925481bec2691f9f21655cabab52502e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab83A4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar85D9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit